Skill UI

This tool analyzes Windows Event Logs (ID 4688, Sysmon ID 1) and WMI-Activity Operational events to detect suspicious lateral movement. It specifically hunts for WmiPrvSE.exe spawning child processes (like cmd.exe or powershell.exe) or identifying WMI event subscriptions, which are common indicators of remote code execution and persistence.

This guide details how to analyze comprehensive Zeek network logs (conn.log, smb_files.log, ntlm.log, dce_rpc.log, etc.) to detect advanced attacker techniques. It specifically targets indicators of compromise related to lateral movement, such as SMB admin share access, NTLM account spraying, and remote service execution (DCE/RPC patterns). It is a critical network forensics tool for post-incident investigation.

This skill provides comprehensive detection strategies for adversaries abusing DCOM objects (e.g., MMC20.Application) to perform stealthy lateral movement (MITRE ATT&CK T1021.003). It details how to correlate Sysmon Event IDs (Process Creation, Network Connection), analyze WMI activity, and monitor RPC traffic on port 135 to identify unauthorized remote command execution chains. Ideal for advanced threat hunting, red teaming, and purple team exercises.

This advanced playbook details expert techniques for format string exploitation. It covers arbitrary stack reading (%p), memory writing (%n), and exploiting weaknesses like GOT/hook overwrites. Essential for CTF challenges and binary vulnerability analysis to achieve reliable Remote Code Execution (RCE).

This expert playbook details advanced techniques for exploiting stack-based vulnerabilities, including classic buffer overflows, Return-Oriented Programming (ROP), ret2libc, and specialized gadgets like ret2csu and SROP. It provides comprehensive guidance on bypassing modern memory mitigations (NX, ASLR, PIE) to hijack program control flow and achieve reliable remote code execution in userland binaries.